From a4f56e90a66e81f85d8e5f81eb3e5781198311c3 Mon Sep 17 00:00:00 2001 From: Vasil Velichkov Date: Tue, 6 Dec 2022 19:29:58 +0200 Subject: [PATCH] BER: Fix extension lengths Previously the length was ignored and if a Sequence contains more then one extensions (in the ellipsis) then the value of the second was wrongly added to the value of the previous one. --- epan/dissectors/packet-ber.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/epan/dissectors/packet-ber.c b/epan/dissectors/packet-ber.c index 1522952683..bda5fb0781 100644 --- a/epan/dissectors/packet-ber.c +++ b/epan/dissectors/packet-ber.c @@ -2266,10 +2266,10 @@ ber_sequence_try_again: if (!seq->func) { /* it was not, move to the next one and try again */ offset = dissect_ber_identifier(actx->pinfo, tree, tvb, hoffset, NULL, NULL, NULL); - dissect_ber_length(actx->pinfo, tree, tvb, offset, NULL, NULL); + offset = dissect_ber_length(actx->pinfo, tree, tvb, offset, &len, NULL); cause = proto_tree_add_expert_format( tree, actx->pinfo, &ei_ber_unknown_field_sequence, - tvb, hoffset, -1, + tvb, hoffset, ((offset - hoffset) + len), "BER Error: This field lies beyond the end of the known sequence definition."); if (decode_unexpected) { proto_tree *unknown_tree = proto_item_add_subtree(cause, ett_ber_unknown);